remember_token migration
use remember_token in session cookie instead of id